Large complex systems such as power plants, aircraft, ships, or even automobiles, increasingly rely upon complex electronic systems to operate. These electronic systems are often critical components that must not fail because such failure could result in a severe system failure. In order to avoid catastrophic failure, large complex systems generally include multiple power sources to power the critical electronic systems so that if one power source fails, the other power source can supply the needed power.
The multiple power sources of large complex systems are typically coupled to multiple power distribution modules that distribute power from the multiple power sources to the critical electronic systems. Ideally, the power distribution modules isolate both power source failures and failures in the critical electronic system, or load, because a failure in either a power source or a load may cause failure of the entire power distribution system. For example, if the power distribution system did not isolate the power sources, a short circuit failure in one power source would also short circuit the output of the second power source (sometimes causing this second power source to fail as well), resulting in total power failure to the critical electronic systems coupled to the power sources. Similarly, if the power distribution modules did not isolate the loads, a short circuit failure in one of the loads would short circuit the output of both power sources, again resulting in total power failure. Thus, without both power source and load isolation, a so-called "single-point failure" is possible. Of course, single-point failures are not acceptable for critical electronic systems.
FIG. 1 shows a conventional power distribution system 100 with "ORing" diodes that is susceptible to single-point failures. Power distribution system 100 includes a power source 102 having an output terminal 104 coupled to a load 106 through a diode 108. The output lead 109 of diode 108 is also connected to a load 110. Power distribution system 100 also includes a second power source 112 having an output terminal 114 coupled to load 110 through a diode 116. The output lead 117 of diode 116 is also connected to load 106. Diodes 108 and 116 are referred to as "ORing" diodes because they operate in a logical OR manner to provide power from either power source 102 or power source 112 to both loads 106 and 110. Thus, for example, if power source 102 fails, power source 112 will supply power to load 106 through ORing diode 116. Similarly, if power source 112 fails, power source 102 will supply power to load 110 through ORing diode 108.
However, if, for example, load 106 were to have a short circuit failure, failed load 106 will short circuit the output terminal 104 of power source 102, thus drawing substantially all of the power supplied by power source 102. In addition, failed load 106 will short circuit output terminal 114 via diode 116, thereby drawing substantially all of the power supplied by power source 112 to failed load 106, resulting in a single-point failure of power distribution system 100.
A further problem with power distribution system 100 is that the ORing diodes dissipate a substantial amount of power. In order to avoid diode destruction, heat sinks are generally supplied for the ORing diodes, thereby increasing the size, weight and cost of the power distribution system. In some applications, such as, for example, aircraft, increasing size and weight is extremely undesirable. Moreover, ORing diodes typically cause a voltage drop of approximately 0.5-0.8 volts during normal operation. In low voltage "in-line" systems, the voltage drop at the ORing diodes is extremely undesirable because the voltage drop represents a large percentage of the power source's output voltage and could significantly degrade the performance of the critical electronic system. For example, many electronic systems now operate with 3.3 volt power. Thus, the voltage drop in the ORing diodes could cause the voltage at the electronic systems to drop below the electronic systems' minimum required voltage, thereby prevent the electronic system from operating.
FIG. 2 shows a block diagram of a conventional power distribution system 200 that replaces ORing diodes 108 and 116 of power distribution system 100 with solid state power controllers (hereinafter "SSPCs") 202, 204, 206 and 208. Like reference numbers are used herein to designate elements with substantially identical structure and function. Power source 102 is coupled to loads 106 and 110 through SSPCs 202 and 208, respectively. Similarly, Power source 112 is coupled to loads 106 and 110 through SSPCs 204 and 206, respectively.
SSPCs 202, 204, 206 and 208 can be any commercially available SSPC, such as, for example, model SSP-21110 available from ILC Data Device Corporation, Bohemia, N.Y. Each SSPC includes a controller, a current sensor and a n-channel power metal-oxide-semiconductor field effect transistor (hereinafter "MOSFET"). The power MOSFETs of power distribution system 200 dissipate significantly less power and drop less voltage compared to the ORing diodes of power distribution system 100 (FIG. 1). The controller switches off the power MOSFET when the sensor detects an output overcurrent condition (indicative of a shorted load failure) to isolate the failed load from the power source. Although SSPCs 202, 204, 206 and 208 provide load fault isolation and lower power dissipation and voltage drop than ORing diodes, four SSPCs are needed to replace two diodes. In addition, an SSPC is a much more complex circuit than a diode. Consequently, power distribution system 200 is significantly more costly than power distribution system 100.
Moreover, power distribution system 200 does not isolate power source failures. The n-channel power MOSFET of each SSPC is coupled so that its source and drain are respectively coupled to the corresponding load and power source. The type of n-channel power MOSFET typically used in a SSPC has an inherent diode (i.e., the so called "body diode") that is coupled between the power MOSFET's source and drain, which is forward biased when the power MOSFET has a positive source-to-drain voltage. The power MOSFET is configured in a typical SSPC so that the power MOSFET's drain and source are coupled to the power source and the load, respectively. In normal operation, the voltages at output terminals 104 and 114 are higher than the voltages at loads 106 and 110, thereby causing the body diodes in the SSPCs to be reverse-biased. Accordingly, when the controller switches off the power MOSFETs, no current can flow from power sources 102 and 112 to loads 106 and 110. However, if, for example, the voltage at output terminal 104 of power source 102 is lower than the voltage at loads 106 and 110 (e.g., when power source 102 experiences a short circuit failure), the body diode in SSPC 202 allows current to be rerouted from load 106 and power source 112 to failed power source 102. Similarly, the body diode in SSPC 208 allows current to be rerouted from power source 112 and load 110 to failed power source 102. Thus, power distribution system 200 is susceptible to a single-point failure because power distribution system 200 does not isolate power source failures.
FIG. 3 shows a schematic diagram of conventional power cross-strapping power distribution system 300 used in some commercial aircraft systems. Power distribution system 300 includes a cross-strapping circuit 301 controlled by an external control unit (not shown). Cross-strapping circuit 301, in normal operation, provides a current path between power source 102 and load 106 via SSPC 202. In addition, cross-strapping circuit 301 provides a current path between power source 112 and load 110 via SSPC 206. Thus, each load has a corresponding power source, and each power source is isolated from the other power source. In addition, SSPCs 202 and 206 are each in a single-load configuration that provides load failure isolation through the body diode of its power MOSFET. The external control unit detects the status of power sources 102 and 112 and provides control signals to cross-strapping circuit 301.
Cross-strapping circuit 301 includes normally-dosed relay 302 between power source 102 and SSPC 202 at a node 305. As a result, power flows from power source 102 to load 106 through node 305 and SSPC 202. Similarly, cross-strapping circuit 301 includes normally-closed relay 308 connected between power source 112 and SSPC 206 at a node 311, thereby allowing power to flow from power source 112 to load 110 through node 311 and SSPC 206. A normally-open relay 312 is connected between nodes 305 and 311.
Power distribution system 300 operates as follows. If, for example, power source 102 were to fall, the external control unit, detecting the failed status of power source 102, would cause relay 302 to open, thereby providing "downstream" isolation from failed power source 102. In a break-before-make manner, the external control unit then causes normally-open relay 312 to close, thereby providing a current path between functional power source 112 and load 106, via relays 308 and 312 and SSPC 202. Conversely, if power source 112 were to fail, the external control unit would cause relay 308 to open and relay 3 12 to close in a break-before-make manner to provide a current path between power source 102 and load 110 via SSPC 206 and relays 312 and 302.
Although power distribution system 300 provides bi-directional fault isolation, the relays and external monitoring and control are relatively slow. Consequently, power interruptions of 20 to 60 ms typically occur, which is undesirable. Therefore, backup batteries are often included in the system, which, of course, add complexity, size, weight and cost to the system. In addition, the external control unit must monitor the power sources and control relay 312, adding complexity to the external control unit.